The problem
The customer was already running Suricata. Signature detection through deep packet inspection gave them high-confidence hits on known malware, exploits, and command-and-control traffic — the moment a packet matched a rule, they knew it by name. What they didn’t have was any sense of what happened around it.
Suricata sees the here and now. It inspects the packet in front of it and moves on; it keeps no history, no baseline, no memory of how a host normally behaves. That’s a hard limit, not a tuning problem — and history is exactly what behavioral analysis runs on. Catching the slow exfiltration, the lateral movement, the quiet drift away from normal all depend on a record over time that the customer simply wasn’t keeping. So every signature hit landed as a name with no story: an alert in its own console, with nothing to say what the host had been doing, what came before or after, or whether this was one event or the visible edge of something larger.
The requirement, then, wasn’t more detection. It was context — keep the signature coverage they’d already invested in, but give it a memory: a timeline behind every hit, a baseline to judge it against, the surrounding network activity to explain it, and one taxonomy to tie it all together.
Implementation
We didn’t replace what the customer had — we gave it a home. Suricata stayed exactly where it was. What was missing sat underneath it, so we deployed Sycope, started collecting flow across NetFlow/sFlow/IPFIX, and let it build the baselines and behavioral detection that only accumulate with history.
Then we brought Suricata in as a first-class detection source. Every signature hit now arrives in Sycope alongside the flow it rode in on and the behavioral findings from the same host at the same moment, mapped onto the same MITRE ATT&CK techniques as everything else — one place, one taxonomy.
The difference shows up at the moment of investigation. A hit on a known C2 pattern no longer lands as a context-free alert in a separate console; it arrives with a story already attached — what that host normally does, what it was doing before and after, and whether the signature is an isolated event or one move in a longer sequence. The name comes from Suricata; the history, the baseline, and the correlation come from Sycope, and the analyst reads the whole thing on a single screen: one host, one timeline.
Keeping the ruleset tuned and current sits with us from here, under professional services — so the coverage stays sharp without pulling the customer’s team back into rule maintenance.
The result is the detection they already trusted, finally given a memory: known threats still named the instant they appear — but now with the history, baseline, and correlation to tell you what that name actually means.
